Ship Safe is an AI security scanner for modern software teams that runs locally in your repository. It detects risks across application code, AI agents, MCP configs, prompts, dependencies, CI/CD, secrets, and cloud-adjacent configuration. Start a scan with one command: npx ship-safe — no signup, no API key required for scanning, works offline for core checks.

The tool finds issues in six categories: AI and LLM security (prompt injection, agent hijacking), MCP and agent configs (over-broad tool permissions), application security (SQL injection, XSS), secrets and compliance (API keys, PII), supply chain (typosquatting, dependency confusion), and CI/CD (pipeline poisoning, unpinned GitHub Actions). It includes 29 specialized agents that run in parallel, each skipping irrelevant projects automatically.

Developers use it for fast local feedback before PRs, during review, or inside CI without sending code to a hosted scanner. Fixes are reviewable diffs before touching files. The open-source CLI is MIT-licensed; paid Pro Team plans add scan history, cloud dashboard, and PDF reports. Ship Safe Cloud is developed privately due to commercial code.

Key agents include LLMRed Team (OWASP LLM Top 10), MCPSecurity Agent, Agentic Security Agent (OWASP Agentic AI Top 10), Model Scan Agent (code-execution payloads in ML weights), and Trust Boundary Agent (ghost approval symlink attacks). CI/CD mode fails on critical findings and uploads SARIF to GitHub code scanning.